UpHeron
All vulnerabilities

Servers and applications

CVE-2024-46990

Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade…

Severity
Medium 5.0
Published
18 Sept 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.13.3, 11.1.0
Sources
NVD

Affected software

SoftwareAffected versions
DirectusServers and applications · cpe:a:monospace:directus
  • Every version before 10.13.3
  • From 11.0.0 before 11.1.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-46990
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-46990